{ "format": "vercy-enterprise-profile-candidate/v1", "contourId": "EM-TEC-07", "name": "Enterprise Vulnerability Exposure and Remediation", "decision": "PROFILE", "newRuntimeId": false, "bases": [ "WM-SFT-006", "WM-ACT-034", "WM-ACT-006", "WM-SFT-007", "WM-SFT-008", "WM-SFT-009", "WM-SFT-012", "WM-ACT-020" ], "constraints": [ "VEX-equivalent product/version/configuration status is mastered exclusively on WM-SFT-006 as a source-qualified assertion; WM-SFT-008, WM-SFT-012, WM-SFT-007, WM-ACT-006, WM-ACT-034 and the Exploit Artifact candidate may cite it and must not author, copy or rewrite it.", "Exposure conclusions never exist as fields on WM-SFT-006, WM-SFT-007, WM-SFT-008, WM-SFT-009, WM-SFT-012 or WM-ACT-006.", "Product and instance vocabularies are disjoint; exposure_undetermined is mandatory when inventory completeness or required observation is absent, while under_investigation is product-scope only.", "Every exposure assessment pins vulnerabilityRevisionRef; if it is not the current accepted WM-SFT-006 revision, lifecycle evaluates to stale and the conclusion is not current, without cascade writes.", "On expiry of any evidence item required by the conclusion, exposureStatus evaluates to exposure_undetermined and never preserves exposure_not_affected or exposure_fixed.", "A WM-SFT-006 configuration condition declares predicateRole required_for_affectedness or contributing; configuration-based exposure_not_affected requires every required predicate observed false by unexpired scoped evidence.", "Fix availability is a source-qualified contained facet of WM-SFT-006; no separate fix master is referenced or allocated in this contour.", "WM-SFT-009 masters deployment and post-deployment verification observations only; WM-ACT-034 masters exposure conclusions only. Exposure_fixed requires a superseding assessment citing deployment of the remediating build and observations covering every criterion behind the prior exposure_affected.", "WM-SFT-007 f-affectedness and f-remediation-status are non-authoritative caches carrying sourceRef and never satisfy invariant evaluation.", "Any transported VEX or exposure copy carries nonAuthoritativeCopy true and sourceRef and is rejected as an input to a conclusion.", "Exposure assessments, reachability determinations and local priority are deny-by-default; read access requires explicit purpose, scope and audit. Embargoed content, reporter identities and artifact references are separately restricted; WM-SFT-009 actor sensitivity is retained.", "All instants are RFC 3339 with seconds and an explicit offset; disposedAt is not earlier than createdAt and assessedAsOf is not earlier than observedAt for every cited observation.", "Provider-local invariant numbering is non-normative; every binding reference uses LS-1 through LS-16." ], "candidateRevision": 3, "status": "provider-reconciled-audited-remediated-allocation-held", "canonicalPublishable": false, "basesAreNonCanonicalDrafts": true, "installabilityClaim": "none", "publicationReadinessClaim": "none", "objects": { "ExposureAssessment": { "identity": [ "exposureAssessmentId" ], "required": [ "subjectDeploymentRef", "vulnerabilityRef", "vulnerabilityRevisionRef", "exposureStatus", "assessedAsOf", "evidenceRefs", "scope" ], "optional": [ "justificationCode", "predicateEvaluations", "reachabilityDetermination", "environmentalRisk", "localPriority", "remediationStatus", "supersedesRef", "supersededByRef", "maxStalenessSeconds" ], "lifecycle": [ "draft", "asserted", "superseded", "stale", "withdrawn" ], "identityRule": "exposureAssessmentId is opaque and independently allocated; it is never derived from vulnerabilityRef, subjectDeploymentRef, assessedAsOf or any combination thereof.", "evidenceTimeRule": "Every required evidence item carries observedAt and maxStalenessSeconds; expiresAt is derived as observedAt plus maxStalenessSeconds." } }, "vocabularies": { "productVexStatus": [ "affected", "not_affected", "fixed", "under_investigation" ], "instanceExposureStatus": [ "exposure_affected", "exposure_not_affected", "exposure_fixed", "exposure_undetermined" ] }, "invariants": [ { "id": "LS-1", "rule": "CVE is not the only valid vulnerability identifier." }, { "id": "LS-2", "rule": "Every affectedness assertion names ecosystem, version scheme, range and configuration conditions." }, { "id": "LS-3", "rule": "Product affectedness never implies deployed-instance exposure." }, { "id": "LS-4", "rule": "Missing inventory or observation yields exposure_undetermined, never exposure_not_affected." }, { "id": "LS-5", "rule": "Exposure_not_affected requires a justification code and evidence." }, { "id": "LS-6", "rule": "Severity, exploitation probability, known exploitation, risk and priority remain distinct." }, { "id": "LS-7", "rule": "Presence, loading, reachability, exploitation and incident remain distinct." }, { "id": "LS-8", "rule": "Fix availability, build inclusion, deployment and verification remain distinct." }, { "id": "LS-9", "rule": "Closed remediation work never proves remediation outcome." }, { "id": "LS-10", "rule": "Conclusions are scoped, as-of and explicitly superseded rather than overwritten." }, { "id": "LS-11", "rule": "A conclusion whose pinned vulnerability revision is not current evaluates to stale and is not readable as current." }, { "id": "LS-12", "rule": "No deletion cascades across vulnerability, component, build, deployment, evidence or incident masters." }, { "id": "LS-13", "rule": "Instance exposure requires independent opaque identity and is never a field on another master." }, { "id": "LS-14", "rule": "Conditional affectedness requires an explicit predicateRole; an absent role defaults to exposure_undetermined and never to exploited or remediated." }, { "id": "LS-15", "rule": "Transported assertion copies are non-authoritative, retain sourceRef and never feed conclusions." }, { "id": "LS-16", "rule": "VEX-equivalent product/version/configuration status is mastered only on WM-SFT-006 and is source-qualified." } ], "constraintRules": [ { "id": "TEC07-CONSTRAINT-001", "rule": "VEX-equivalent product/version/configuration status is mastered exclusively on WM-SFT-006 as a source-qualified assertion; WM-SFT-008, WM-SFT-012, WM-SFT-007, WM-ACT-006, WM-ACT-034 and the Exploit Artifact candidate may cite it and must not author, copy or rewrite it." }, { "id": "TEC07-CONSTRAINT-002", "rule": "Exposure conclusions never exist as fields on WM-SFT-006, WM-SFT-007, WM-SFT-008, WM-SFT-009, WM-SFT-012 or WM-ACT-006." }, { "id": "TEC07-CONSTRAINT-003", "rule": "Product and instance vocabularies are disjoint; exposure_undetermined is mandatory when inventory completeness or required observation is absent, while under_investigation is product-scope only." }, { "id": "TEC07-CONSTRAINT-004", "rule": "Every exposure assessment pins vulnerabilityRevisionRef; if it is not the current accepted WM-SFT-006 revision, lifecycle evaluates to stale and the conclusion is not current, without cascade writes." }, { "id": "TEC07-CONSTRAINT-005", "rule": "On expiry of any evidence item required by the conclusion, exposureStatus evaluates to exposure_undetermined and never preserves exposure_not_affected or exposure_fixed." }, { "id": "TEC07-CONSTRAINT-006", "rule": "A WM-SFT-006 configuration condition declares predicateRole required_for_affectedness or contributing; configuration-based exposure_not_affected requires every required predicate observed false by unexpired scoped evidence." }, { "id": "TEC07-CONSTRAINT-007", "rule": "Fix availability is a source-qualified contained facet of WM-SFT-006; no separate fix master is referenced or allocated in this contour." }, { "id": "TEC07-CONSTRAINT-008", "rule": "WM-SFT-009 masters deployment and post-deployment verification observations only; WM-ACT-034 masters exposure conclusions only. Exposure_fixed requires a superseding assessment citing deployment of the remediating build and observations covering every criterion behind the prior exposure_affected." }, { "id": "TEC07-CONSTRAINT-009", "rule": "WM-SFT-007 f-affectedness and f-remediation-status are non-authoritative caches carrying sourceRef and never satisfy invariant evaluation." }, { "id": "TEC07-CONSTRAINT-010", "rule": "Any transported VEX or exposure copy carries nonAuthoritativeCopy true and sourceRef and is rejected as an input to a conclusion." }, { "id": "TEC07-CONSTRAINT-011", "rule": "Exposure assessments, reachability determinations and local priority are deny-by-default; read access requires explicit purpose, scope and audit. Embargoed content, reporter identities and artifact references are separately restricted; WM-SFT-009 actor sensitivity is retained." }, { "id": "TEC07-CONSTRAINT-012", "rule": "All instants are RFC 3339 with seconds and an explicit offset; disposedAt is not earlier than createdAt and assessedAsOf is not earlier than observedAt for every cited observation." }, { "id": "TEC07-CONSTRAINT-013", "rule": "Provider-local invariant numbering is non-normative; every binding reference uses LS-1 through LS-16." } ], "holds": [ "All named bases remain non-canonical drafts; WM-SFT-006 independent-review waiver and non-canonical status are both recorded and unreconciled.", "WM-SFT-008 and WM-SFT-012 VEX boundary texts contradict this allocation and require amendment before canonicalisation; amendment rows are absent.", "WM-SFT-007 affectedness and remediation cache boundary text remains unamended.", "Staleness propagation contract between WM-SFT-006 and WM-ACT-034 is unapproved.", "Relation-ledger rows backing every declared reference, including WM-SFT-006 outgoing relations, are absent; no reference is approved.", "WM-ACT-034 privacy contract remains open; security handling and disclosure controls require specialist approval.", "CVE, NVD, OSV, CSAF, VEX, STIX, CWE and CVSS crosswalks and fixtures are unverified.", "Exploit Artifact registry allocation, package conversion and live verification remain pending." ] }